class

CVSS::V4::Vector

Inherits CVSS::Vector < Comparable < Reference < Object

CVSS v4.0 vector.

vec = CVSS::V4::Vector.parse("CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N")
vec.base_score # => 9.3
vec.severity   # => CVSS::Severity::Critical

Constants

BASE_REQUIRED = ["AV", "AC", "AT", "PR", "UI", "VC", "VI", "VA", "SC", "SI", "SA"] of ::String
METRIC_ORDER = ["AV", "AC", "AT", "PR", "UI", "VC", "VI", "VA", "SC", "SI", "SA", "E", "CR", "IR", "AR", "MAV", "MAC", "MAT", "MPR", "MUI", "MVC", "MVI", "MVA", "MSC", "MSI", "MSA", "S", "AU", "R", "V", "RE", "U"] of ::String

Canonical metric ordering used by to_s. Matches the FIRST calculator.

Constructors

new(av : AttackVector, ac : AttackComplexity, at : AttackRequirements, pr : PrivilegesRequired, ui : UserInteraction, vc : VulnerableImpact, vi : VulnerableImpact, va : VulnerableImpact, sc : SubsequentImpact, si : SubsequentImpact, sa : SubsequentImpact, e : ExploitMaturity | Nil = nil, cr : SecurityRequirement | Nil = nil, ir : SecurityRequirement | Nil = nil, ar : SecurityRequirement | Nil = nil, mav : ModifiedAttackVector | Nil = nil, mac : ModifiedAttackComplexity | Nil = nil, mat : ModifiedAttackRequirements | Nil = nil, mpr : ModifiedPrivilegesRequired | Nil = nil, mui : ModifiedUserInteraction | Nil = nil, mvc : ModifiedVulnerableImpact | Nil = nil, mvi : ModifiedVulnerableImpact | Nil = nil, mva : ModifiedVulnerableImpact | Nil = nil, msc : ModifiedSubsequentConfidentiality | Nil = nil, msi : ModifiedSubsequentIntegrity | Nil = nil, msa : ModifiedSubsequentAvailability | Nil = nil, s : Safety | Nil = nil, au : Automatable | Nil = nil, r : Recovery | Nil = nil, v : ValueDensity | Nil = nil, re : ResponseEffort | Nil = nil, u : ProviderUrgency | Nil = nil)
Source
parse(input : String) : Vector
Source

Class methods

parse?(input : String) : Vector | Nil

Non-raising parse — returns nil if the input is malformed.

Source

Instance methods

==(other : self)

Returns true if this reference is the same as other. Invokes same?.

adjacent_network?
Source
av

Base

Source
base_score
Source
cr

Environmental — Security Requirements

Source
e

Threat

Source
effective_code(name : String) : String

Mirror of the JS m() function — applies X-defaults and Modified overrides when the score algorithm asks for an effective metric value.

Source
environmental_score
Source
environmental_set?

True when any Environmental metric (Security Requirements or Modified base) carries a meaningful (non-X) value.

Source
hash(hasher)

See Object#hash(hasher)

impacts_availability?
Source
impacts_confidentiality?

Vulnerable system has any non-None impact.

Source
impacts_integrity?
Source
impacts_subsequent_system?

Subsequent system has any non-None impact (any of SC/SI/SA != N).

Source
local?
Source
macro_vector

The 6-character MacroVector this vector falls into. Concatenates EQ1 EQ2 EQ3 EQ4 EQ5 EQ6 digits as defined in the CVSS v4.0 spec.

CVSS::V4::Vector.parse("CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N").macro_vector
# => "000200"
Source
mav

Environmental — Modified base

Source
metric_value(name : String) : String

Return the raw code stored for a metric, or "X" if unset.

Source
network?
Source
nomenclature

Vector nomenclature per CVSS v4.0 spec §6 — classifies the vector by which optional metric groups are populated (Base only, +Threat, +Environmental, or both).

vec = CVSS::V4::Vector.parse("CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N")
vec.nomenclature.to_s  # => "CVSS-B"
vec.nomenclature.base? # => true
Source
physical?
Source
requires_privileges?
Source
requires_user_interaction?
Source
s

Supplemental (informational only)

Source
severity
Source
threat_score

In v4.0 the single score is the threat/environmental-aware score (Threat metrics are part of the macro-vector). We expose aliases for API symmetry with the v3 vector class.

Source
threat_set?

True when the Threat metric group has a meaningful value (E set and not X).

Source
to_h

Returns a Hash(String, String) of metric short-codes, in canonical order. Optional metrics are only included when set. Note that supplemental metric U (Provider Urgency) keeps its full word value ("Clear" / "Green" / "Amber" / "Red") rather than a single letter.

Source
to_s(io : IO) : Nil

Appends a short String representation of this object which includes its class name and its object address.

class Person
  def initialize(@name : String, @age : Int32)
  end
end

Person.new("John", 32).to_s # => #<Person:0x10a199f20>
Source
version
Source